CVE-2020-35364

Beijing Huorong Internet Security 5.0.55.2 allows a non-admin user to escalate privileges by injecting code into a process, and then waiting for a Huorong…

published December 26, 2020

CVSS
—
EPSS
2%
Percentile
79.5
In the wild
Unconfirmed
What it is

⚠️ Just a little code injection can lead to big trouble! A non-admin user can escalate privileges in Huorong Internet Security by waiting for a service restart. 👀 Think of it as sneaking a note into an office's inbox that gets opened only when the office manager comes back from lunch — a clever way to bypass security checks that only happen during those specific moments. 📬 If exploited, this could allow a non-admin user to gain admin-level access, potentially giving them the keys to the entire system! They could manipulate settings, access sensitive data, or even disable security features—definitely a recipe for chaos! 🔥

Put simply

Think of it as sneaking a note into an office's inbox that gets opened only when the office manager comes back from lunch — a clever way to bypass security checks that only happen during those specific moments. 📬 This vulnerability enables a non-admin user to inject code into a running process of Huorong Internet Security and gain elevated privileges upon the next service restart or system reboot, effectively bypassing intended security measures.

What to do

If exploited, this could allow a non-admin user to gain admin-level access, potentially giving them the keys to the entire system! They could manipulate settings, access sensitive data, or even disable security features—definitely a recipe for chaos! 🔥 Ensure that all users are appropriately assigned permissions and monitor for any unauthorized activity. Consider updating to the latest version of Huorong Internet Security to mitigate this risk. Conduct regular audits of user privileges to prevent such escalations in the future. You've got this! Stay vigilant, and you'll keep your systems secure! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01898 · 79.5th percentile
Published
2020-12-26T18:20Z
EPSS history
Timeline
  • 26 DEC 18:20Z
    Beijing Huorong Internet Security 5.0.55.2 allows a non-admin user to escalate privileges by injecting code into a process, and then waiting for a Huorong…
    cvelistv5